Resetting the Provisioning Repository Password on Windows - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article details the recovery procedure for resolving a credential mismatch between the Identity Manager Provisioning Directory (IMPD) and the registry, which prevents the Identity Manager Provisioning Server (IMPS) service from starting.

Environment

Identity Manager 14.5

Cause

A mismatch between the password stored in the IMPD and the local registry file results in an authentication failure, characterized by LDAP_INVALID_CREDENTIALS errors in the etatrans log.

Resolution

Phase 1: Enable Anonymous Access

Perform these steps on all Provisioning Repository machines.

1. Stop the CA Identity Manager Provisioning Server service via Windows Services.
2. Open a Command Prompt as Administrator and stop the Directory Server: dxserver stop all
3. Edit the configuration file (e.g., C:\Program Files\CA\Directory\dxserver\config\settings\impd.dxc) and change set min-auth = clear-password; to set min-auth = none;.
4. Edit all repository knowledge files in C:\Program Files\CA\Directory\dxserver\config\knowledge\ (e.g., *-impd-co.dxc, *-impd-main.dxc).
5. Change auth-levels = clear-password to auth-levels = anonymous, clear-password.
6. Start the Repository DSAs: dxserver start all

Phase 2: Reset the LDAP Password

1. Connect to the Provisioning Repository machine on port 20391 anonymously using an LDAP browser (e.g., JXplorer).
2. Update the userPassword value for the following entries:
   • eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb
   • eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb
   • Note: If prompted for an algorithm, select "SSHA".

Phase 3: Clear Registry Settings

Perform these steps on all machines hosting the Provisioning Server.

1. Backup the registry entries located at:
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ComputerAssociates\Identity Manager\Provisioning Server\Domains\eta
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ComputerAssociates\Identity Manager\Provisioning Server\Domains\im
2. Delete the eTPasswordDB key within both of the above paths.
3. Restart the CA Identity Manager Provisioning Server service.

Phase 4: Re-establish Repository Password

1. Verify the etatrans log indicates the system is using anonymous access.
2. Run the Password Manager utility (pwdmgr.exe), located typically at: c:\Program Files (x86)\CA\Identity Manager\Provisioning Server\bin\pwdmgr.exe
3. Follow the prompts to set the new password for both the eta and im domains.
4. Restart the Provisioning Server service once the new password is set.

Phase 5: Disable Anonymous Access

Perform these steps on all Provisioning Repository machines.

1. Revert the min-auth and auth-levels settings in the configuration and knowledge files (configured in Phase 1) back to clear-password.
2. Restart the DSAs: dxserver init all
3. Restart the CA Identity Manager Provisioning Server service.

Additional Information

Also please refer to the associated Knowledge Article - How to reset the Provisioning Repository password for IMPS on Linux

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.